OPC Consent Model Submission

Disclaimer: The opinions expressed in this document are those of the author(s) and do not necessarily reflect those of the Office of the Privacy Commissioner of Canada.

Summary

This paper attempts to explain the current policy gaps within the information consent model in Canada, and how these gaps can be resolved through policy and legislative changes. It examines the Personal Information and Protection of Electronic Documents Act (PIPEDA) and the Office of the Privacy Commissioner’s (OPC) position on the consent model, and uses online behavioural adverting as an example to illustrate the drawbacks of this model. Some notable issues include: the circumvention of consumer’s selective information revelation choices, allowing implied consent to online tracking and cookie installation, and allowing information collection to be a condition of service for online applications. This paper supports the OPC’s proposed solutions of enhancing the meaningful consent model by promoting notice and informed consent, as well as strengthening accountability for privacy compliance. Other tools that are used evade an individual’s autonomy over information about themselves undermine the privacy rights of Canadians, such as forum selection clauses that can be used to evade PIPEDA and weak opt-out mechanisms. The OPC’s reliance on consumer complaints to address privacy violations, and lack of order-making power to legally enforce its recommendations, result in a precarious privacy regime. This paper recommends that the OPC seek order-making power to increase privacy enforcement capabilities. It also recommends that businesses should be required to provide a short privacy summary of their services to clearly communicate important information practices.